This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-4-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-4-test by this push:
new a3dbd99a833 [v3-4-test] Mount the checkout read-only in the hadolint
and RAT prek hooks (#76162) (#76167)
a3dbd99a833 is described below
commit a3dbd99a833886e6390265644407d8222e5779d5
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Sat Oct 31 20:55:09 2026 +0100
[v3-4-test] Mount the checkout read-only in the hadolint and RAT prek hooks
(#76162) (#76167)
Both containers only read the tree, but mounted it writable. A
container-gateway refuses a writable bind of a checkout root, since it would
let the container rewrite .claude/settings.json, .git/hooks and similar files
that run code outside the agent sandbox, so the two hooks failed under it in
every checkout and agent worktree.
(cherry picked from commit 2e62fd8603753b86a72db6f4b42c2cb3547d2646)
Generated-by: Claude Opus 5
Co-authored-by: Jarek Potiuk <[email protected]>
---
scripts/ci/prek/check_license.py | 2 +-
scripts/ci/prek/lint_dockerfile.py | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/ci/prek/check_license.py b/scripts/ci/prek/check_license.py
index 1eb3470f682..944f5546d67 100755
--- a/scripts/ci/prek/check_license.py
+++ b/scripts/ci/prek/check_license.py
@@ -32,7 +32,7 @@ cmd = [
"docker",
"run",
"-v",
- f"{AIRFLOW_ROOT_PATH}:/opt/airflow",
+ f"{AIRFLOW_ROOT_PATH}:/opt/airflow:ro",
"-t",
"--user",
f"{os.getuid()}:{os.getgid()}",
diff --git a/scripts/ci/prek/lint_dockerfile.py
b/scripts/ci/prek/lint_dockerfile.py
index ecf5254c461..854eb833485 100755
--- a/scripts/ci/prek/lint_dockerfile.py
+++ b/scripts/ci/prek/lint_dockerfile.py
@@ -30,7 +30,7 @@ cmd = [
"docker",
"run",
"-v",
- f"{AIRFLOW_ROOT_PATH}:/root",
+ f"{AIRFLOW_ROOT_PATH}:/root:ro",
"-w",
"/root",
"--rm",
